Topic
Practices and infrastructure for discovering, prioritizing, disseminating and remediating software vulnerabilities.
VulnCheck counted Chrome CVEs up 563% and GitHub-issued CVEs up 476% year to date in a May 14, 2026 post. It calls the rise consistent with AI-assisted bug finding, but whether the volume lasts is unknown, so exploitation data still sets patch order.
Reality
Palo Alto Networks' May 13, 2026 advisory for CVE-2026-0257 rates the 7.8-score GlobalProtect bypass at highest urgency after limited exploit attempts. Exposure needs authentication override cookies plus a specific certificate setup, and the fix costs users one re-login.
Reality
F5 fixed eleven NGINX flaws, three of them critical. Each of the three depends on a specific configuration, and SecurityWeek reports that neither F5 nor Juniper mentions exploitation in the wild.
Reality
Citrix's critical NetScaler flaw CVE-2026-19490 is exploitable only on appliances running a Gateway or AAA virtual server role, a DEV Community analysis of the advisory says. The other August flaw depends on a different setting, so role sets the patch order.
Reality
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), a PAN-OS management RCE it says is under limited exploitation. CISA gave federal agencies until October 17; exploiting it takes a valid login and network access to the management interface.
Perspective Coverage
5 publishersReality
Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect and Prisma Access authentication bypass disclosed in May. ReliaQuest says access through a victim's own VPN can look like remote work until credential theft or ransomware deployment is underway.
Reality
Chainguard's 1,300-leader survey finds 66% at $1bn-plus firms knowingly leave high or critical flaws unpatched at least sometimes, versus 27% under $250m. The all-respondent rate is 54%, LeadDev reported, with testing and disruption the stated blockers.
Perspective Coverage
4 publishersReality
CISA added four exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS to KEV with an October 17 federal deadline. We would take the Cisco gateway first, then AhsayCBS servers already patched once, then PAN-OS.
Perspective Coverage
3 publishersReality
Cisco patched CVE-2026-76519, an exploited Secure Email Gateway flaw that gives unauthenticated attackers root through a crafted email attachment. Devices with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected.
Perspective Coverage
5 publishersReality
Cisco Talos counts more than 70,000 CVEs by the end of September, up 105% on a year earlier, while CISA's KEV catalog grew 37%. Its newsletter says the backlog of exploited bugs from older CVEs is where the patching work sits.
Reality
Google's Chrome 155 stable update, versions 155.0.8059.79/.80, fixes 37 security flaws, seven of them rated Critical. Malwarebytes says auto-update can stall on a browser that never closes or one with a blocking extension, so the installed build number is the thing to verify.
Reality
NGINX 1.30.6 and 1.31.7, released October 14, fix five flaws, three of them memory bugs that F5 scores 9.2 Critical on CVSS v4.0. F5 scores a fourth, in TLS session handling, at 8.3; it may let a forged session past client-certificate checks.
Reality
CISA added five exploited flaws in BIND, ProFTPD, Struts, ONLYOFFICE and Strapi to its KEV catalog on 8 October, each due 11 October. All five run on self-hosted servers, so the work starts with an inventory and a compromise check.
Reality
GitLab has patched CVE-2026-90970, a CVSS 9.9 flaw that lets any authenticated Duo Agent Platform user run arbitrary commands on the AI Gateway server. Fixed releases are 19.2.4, 19.3.2 and 19.4.1 for self-hosted installs.
Reality
IBM disclosed CVE-2026-96119 on October 13, 2026, a CVSS 9.9 code-injection flaw in the HTTP Server Administration app on IBM i 7.3, 7.4, 7.5 and 7.6. Exploitation needs a valid login to that app, so limiting who can reach it works before the patch lands.
Reality
GitLab patched CVE-2026-97229, an integer overflow in its CI/CD regex compiler that lets unauthenticated users run code on self-managed servers. Separately, Let's Encrypt's 64-day production certificates start February 10, 2027, so renewal automation needs a test run first.
Reality
Nozomi Networks Labs reports persistent abuse of weak or default credentials and exposed industrial and IoT assets between June and August 2026. Faster exploit cycles and botnets that generate opportunistic traffic add volume on top, the vendor says.
Reality
GitLab fixed CVE-2026-97229, a maximum-severity flaw that could let remote attackers run code, in releases 19.2.8, 19.3.4 and 19.4.2. GitLab.com already runs the fix and Dedicated customers need do nothing, so the work falls on self-managed operators.
Perspective Coverage
7 publishersReality
In a post on aminrj.com, an OWASP working-group member says CVEs fit only two of six places where AI agent and MCP flaws live. Over-broad permissions, shared service accounts and confused-deputy designs sit in the other four, where a scanner has nothing to flag.
Reality
Security · October 4, 2026 · Confirmed11 publishers
Security · September 16, 2026 · Confirmed10 publishers
Security · September 11, 2026 · Confirmed13 publishers
Security · October 1, 2026 · Confirmed6 publishers
Security · September 18, 2026 · Confirmed2 publishers
Leadership · October 1, 2026 · Confirmed2 publishers
Product · September 14, 2026 · Confirmed3 publishers
Product · September 29, 2026 · Confirmed2 publishers
Security · August 15, 2026 · Confirmed2 publishers
Security · August 14, 2026 · Confirmed4 publishers
Security · August 14, 2026 · Confirmed3 publishers
Security · August 18, 2026 · Confirmed2 publishers
Security · August 18, 2026 · Confirmed3 publishers
Security · August 19, 2026 · Confirmed2 publishers
Security · August 20, 2026 · Confirmed4 publishers
Security · August 20, 2026 · Confirmed5 publishers
Security · August 29, 2026 · Confirmed4 publishers
Security · September 6, 2026 · Confirmed2 publishers
Security · September 10, 2026 · Confirmed2 publishers
Security · September 15, 2026 · Confirmed3 publishers
Security · September 25, 2026 · Confirmed2 publishers
Security · September 18, 2026 · Confirmed4 publishers
Security · September 23, 2026 · Confirmed6 publishers